Protect readings, conversations, and administrative records
Map the path from the patient's device or form to the clinical record. Include exports, support tickets, vendor access, and staff notifications. A message that contains a person's name and measurement may reveal health information even outside the formal chart. Limit the data shown to workers who only need to arrange appointments.
HHS requires covered providers and plans to use appropriate telehealth technology and business associate arrangements. Review the responsibilities of each organization involved in the proposed service. HHS technology and privacy guidance
If the company also offers a separate consumer tracking product, assess its legal status independently. The FTC Health Breach Notification Rule covers qualifying personal-health-record businesses outside HIPAA. Its guidance includes unauthorized disclosures, not only intrusion by a hacker. FTC health-data guidance
Test an accidental disclosure with fictional data. Staff should know how to preserve evidence, stop further exposure, and reach the responsible privacy lead.